CVE-2024-47578

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. On successful exploitation, the attacker can read or modify any file and/or make the entire system unavailable.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Dec 10, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-475796.8An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system serveCVE-2024-47587.6The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attacCVE-2024-475806.8An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the CVE-2024-475814.3SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escCVE-2024-475825.3Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity ExpaCVE-2024-475854.3SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should hCVE-2024-475865.3SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request whCVE-2024-475873.5Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low CVE-2024-475884.7In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are wriCVE-2024-47595.5The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as AuCVE-2024-475908.8An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this CVE-2024-475925.3SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs
CVE-2024-47578: Critical severity, CVSS 9.1 | Vulnix